Reliance Steel (RS) Risk Analysis

We review the recoverability of goodwill and indefinite-lived intangible assets annually or whenever significant events or changes in circumstances occur that might impair the recovery of recorded costs. Factors that may be considered a change in circumstances, indicating that the carrying value of our goodwill or indefinite-lived intangible assets may not be recoverable, include a decline in stock price and market capitalization, declines in the market conditions for our products, viability of end markets, loss of customers, reduced future cash flow estimates, and slower growth rates in our industry. If prices for the products our customers sell fall substantially or remain low for a sustained period, we may be (i) unable to realize a profit from businesses that service such customers, (ii) required to record additional impairments, or (iii) required to suspend or reorganize operations that service such customers. An impairment charge, if incurred, could be material.

We are subject to a variety of litigation and legal compliance risks. These risks include, among other things, possible liability relating to product liability, personal injuries, intellectual property rights, contract-related claims, government contracts, taxes, environmental matters and compliance with U.S. and foreign laws, including competition laws and laws governing improper business practices. We or one of our subsidiaries could be charged with wrongdoing as a result of such matters. If convicted or found liable, we could be subject to significant fines, penalties, repayments, or other damages (in certain cases, treble damages). As a global business, we are subject to complex laws and regulations in the U.S. and other countries in which we operate. Those laws and regulations may be interpreted in different ways. They may also change from time to time and so may their related interpretations. Changes in laws or regulations could result in higher expenses and payments, and uncertainty relating to laws or regulations may also affect how we conduct our operations and structure our investments and could limit our ability to enforce our rights.

Seven percent of our 2023 consolidated net sales were from operations outside the U.S., subjecting us to the risks of doing business on a global level. These risks include changes in tax rates, fluctuations in currency exchange rates, economic instability and disruptions, restrictions on the transfer of funds and the imposition of duties and tariffs. Additional risks from our multinational business include transportation delays and interruptions, war, terrorist activities, epidemics, pandemics, political instability, import and export controls, local regulation, changes in governmental policies, inflation, labor unrest and current and changing regulatory environments. International political and military conflict, such as the war in Ukraine, increasing tensions between Taiwan and China, or evolving events in Israel and Gaza could materially adversely affect the global economy. In addition, government policies on international trade and investment such as import quotas, tariffs, and capital controls, whether adopted by individual governments or addressed by regional trade blocs, can affect the demand for our customers' products and services. The implementation of more restrictive trade policies, such as higher tariffs or new barriers to entry, in countries in which our customers sell large quantities of products and services could negatively impact our business, results of operations and financial condition. The Organization for Economic Cooperation and Development ("OECD") has created a framework among 140 countries with the objective of implementing a global minimum effective tax rate of 15%. While we do not anticipate a material impact to our effective income tax rate under these changes, as additional jurisdictions adopt this legislation and the rules continue to evolve, our effective income tax rate and income taxes paid could increase in future years. Our operating results could be negatively affected by the global laws, rules and regulations, as well as political environments in the jurisdictions in which we operate. For example, we are subject to the FCPA, and similar worldwide anti-bribery laws in non-U.S. jurisdictions such as the United Kingdom's Bribery Act 2010, which generally prohibit companies and their intermediaries from corruptly paying, offering to pay, or authorizing the payment of money, a gift, or anything of value, to a foreign official or foreign political party, for purposes of obtaining or retaining business. A company can be held liable under these anti-bribery laws not just for its own direct actions, but also for the actions of its foreign subsidiaries or other third parties, such as agents or distributors. In addition, we could be held liable for actions taken by employees or third parties on behalf of a company that we acquire. If we fail to comply with the requirements under these laws and regulations, we may face possible civil and/or criminal penalties, which could have a material adverse effect on our business or financial results.

The metals service center industry is cyclical and impacted by both market demand and metals supply. Periods of economic slowdown (such as global or regional recessions) decrease the demand for our products and adversely affect our pricing. If either demand or pricing were to decline from the current levels, this could reduce our profitability and cash flows. We sell many products to industries that are cyclical, such as the non-residential construction, semiconductor, energy, automotive, aerospace and heavy equipment industries. Although many of our direct sales are to sub-contractors or job shops that may serve many customers and industries, the demand for our products is directly related to, and quickly impacted by, demand for the finished goods manufactured by customers in these industries, which may change as a result of changes in the general U.S. or worldwide economy, inflation, domestic exchange rates, energy prices or other factors beyond our control.

Concern about climate change might result in new legal and regulatory requirements to reduce or mitigate the effects of climate change. While we believe our operations do not emit significant amounts of carbon dioxide or other greenhouse gases, legal or regulatory changes related to climate change may result in higher prices for metal, higher prices for utilities required to run our facilities, higher fuel costs for us and our suppliers, increased compliance costs and other adverse impacts. To the extent that new legislation or regulations increase our costs, we may not be able to fully pass these costs on to our customers without a resulting decline in sales and adverse impact to our profits. Changing market dynamics, global policy developments, and the increasing frequency and impact of extreme weather events on critical infrastructure in the U.S. and elsewhere have the potential to disrupt our business, the business of our third-party suppliers, and the business of our customers, and may cause us to experience higher attrition, losses and additional costs to maintain or resume operations. There is also increased focus by governmental and non-governmental entities on sustainability matters. Any perception that we have failed to act responsibly regarding climate change could result in negative publicity and adversely affect our business and reputation. There also has been increased stakeholder focus, including by U.S. and foreign governmental authorities, investors, customers, media and nongovernmental organizations, on environmental sustainability matters, such as climate change, the reduction of greenhouse gases and water consumption. Legislative, regulatory or other efforts to combat climate change or other environmental concerns could result in future increases in taxes, restrictions on or increases in the costs of supplies, transportation and utilities, any of which could increase our operating costs, and necessitate future investments in facilities and equipment. Further, our customers may impose emissions reduction or other environmental standards and requirements. As a result, we may experience increased compliance burdens and the sourcing of our products may be adversely affected. These risks also include the increased pressure to make commitments, set targets, or establish additional goals to take actions to meet them, which could expose us to market, operational, execution and reputational costs or risks. ? Developing and acting on initiatives within the scope of social and environmental sustainability, and collecting, measuring and reporting environmental sustainability-related information and metrics can be costly, difficult and time consuming and is subject to evolving reporting standards. Further, statements about our social and environmental sustainability-related initiatives and goals, and progress against those goals, may be based on standards for measuring progress that are still developing, internal controls and processes that continue to evolve, and assumptions that are subject to change in the future. If our social and environmental sustainability-related data, processes and reporting are incomplete or inaccurate, or if we fail to achieve progress with respect to our goals within the scope of social and environmental sustainability on a timely basis, or at all, our reputation, business, financial performance and growth could be adversely affected.

We rely upon information technology systems and networks in connection with the operation of our business, some of which are managed by third parties, to process, transmit and store electronic information. These systems and networks may include operational technology systems that we use to operate and manage our equipment and inventory. Additionally, we collect and store data that is sensitive to our company, including proprietary business information and the personal information of our employees, customers or others. Operating these information technology systems and networks and processing and maintaining this data, in a secure manner, is critical to our business operations and strategy. Our information management systems and the data contained therein are vulnerable to threats and disruption, including interruption due to power loss, system and network failures, operator negligence and similar causes. In addition, our systems and data are susceptible to cybersecurity incidents, such as viruses, malware, ransomware and other cybersecurity attacks. Cybersecurity attacks are increasing in frequency and sophistication. Cybersecurity attacks may range from random attempts to coordinated and targeted attacks, including sophisticated computer crime and advanced threats. These threats pose a risk to the security of our information technology systems and networks and the confidentiality, availability and integrity of our data. We have experienced cybersecurity events such as viruses and attacks on our IT systems. To date, none of these events has had a material impact on our operations or financial results. Despite our efforts to protect our systems, networks and data, we cannot guarantee protection from all cybersecurity incidents, including theft, misplaced or lost data, programming errors, or employee errors that could potentially lead to the compromise of such data, improper use of our systems, software solutions or networks, unauthorized access, use, disclosure, modification or destruction of information, defective products, production downtimes and operational disruptions. Furthermore, data protection laws and regulations around the world often require "reasonable," "appropriate" or "adequate" technical and organizational security measures, and the interpretation and application of those laws and regulations are often uncertain and evolving; there can be no assurance that our security measures will be deemed adequate, appropriate or reasonable by a regulator or court. Moreover, even security measures that are deemed appropriate, reasonable, and/or in accordance with applicable legal requirements may not be able to protect the information we maintain. Given the unpredictability of the timing, nature and scope of security incidents such as cybersecurity attacks or potential disruptions, we are subject to production downtimes, operational delays, other detrimental impacts on our operations or ability to provide products and services to our customers, the compromising, misappropriation, destruction or corruption of data, unauthorized access to or acquisition of data, other manipulation or improper use of our systems or networks, financial losses from remedial actions, loss of business or potential liability, and/or damage to our reputation, any of which could have a material adverse effect on our competitive position, results of operations, cash flows or financial condition. Any significant compromise of our information management systems and networks or data could impede or interrupt our business operations and may result in negative consequences including loss of revenue, fines, penalties, litigation, reputational damage, regulatory actions or increased regulatory scrutiny, inability to accurately and/or timely complete required filings with government entities including the SEC and the Internal Revenue Service, unavailability or disclosure of confidential information (including personal data), negative impact on our stock price, environmental damage, and personal injury or death. Furthermore, we may be required to expend significant attention and financial resources to protect against physical or security incidents that could result in the misappropriation of our information or the information of our employees and customers. While we have purchased cybersecurity insurance, there are no assurances that the coverage would be adequate in relation to any incurred losses. Moreover, as cyber-attacks increase in frequency and magnitude, we may be unable to obtain cybersecurity insurance in amounts and on terms we view as adequate for our operations.